The AI Act Is Now Enforced: Why Spreadsheets Won't Be Enough

The EU AI Act has stopped being a future problem. Since 2 August 2026 the transparency obligations in Article 50 apply, the penalty regime has teeth, and the European Commission's AI Office can now enforce the rules on general-purpose AI models directly. National market surveillance authorities are in place across the Member States.

Many organisations relaxed when the Digital Omnibus pushed back the high-risk deadlines. That was the wrong lesson. The delay moved the date. It did not change the work, and the work is the part most teams are still doing in spreadsheets.

What actually changed, and what didn't

The Omnibus gave organisations more time for high-risk systems. It did not give them a pass:

• 2 August 2026: Article 50 transparency duties apply. Chatbots must tell people they are talking to an AI. Synthetic audio, image, video and text must be marked in a machine-readable way. Deepfakes must be disclosed.
• 2 December 2026: providers of generative systems already on the market before August must have technical marking in place. The new ban on AI that generates non-consensual intimate imagery also bites after its transition period.
• 2 December 2027: obligations for stand-alone high-risk systems in Annex III apply. This covers areas such as employment, education, credit, essential public services, migration and law enforcement.
• 2 August 2028: obligations for AI embedded in regulated products under Annex I apply.

Article 50 breaches sit in a penalty tier of up to €15 million or 3% of worldwide turnover. The prohibited practices carry up to €35 million or 7%. These are maximums, not automatic fines, but they make the point: regulators are now expected to act.

For a public authority or a large company, December 2027 is closer than it looks. A procurement cycle, a supplier change and a system rebuild can easily take that long.

Why the spreadsheet breaks

Most organisations started their AI Act work the same way. Someone built an inventory in Excel: system name, owner, vendor, risk category, status. It was a reasonable first step. It is not a compliance system.

The AI Act is built around evidence that stays current over the life of a system. A spreadsheet captures a moment. Here is where it fails.

• It goes stale the day it is saved. Models are retrained, prompts change, vendors ship new versions, and teams quietly adopt new tools. The register says one thing and production says another.
• It cannot prove anything. When an authority asks what a system did on a given date, a cell that says "compliant" is not evidence. You need logs, versions, test results and decisions that can be traced and that nobody can quietly edit afterwards.
• It has no owner workflow. Risk assessments, human oversight checks and incident reports need named people, deadlines and sign-off. Email threads and comment boxes do not give you an audit trail.
• It does not see your suppliers. Much of your AI risk sits in third-party products. The Act expects deployers to use systems according to the provider's instructions and to monitor them. A spreadsheet has no link to what the vendor has actually changed.
• It does not scale. Ten systems can be tracked by hand. Two hundred cannot, and most medium-sized organisations already use more AI than they think once embedded features in office, HR and CRM software are counted.

What "good" looks like

Compliance under the AI Act is not a report you write once. It is evidence you keep current. In practice that means four things.

1. A living AI register

Every AI system, including embedded features in bought software, recorded with its purpose, owner, provider, risk classification and the Article 50 or high-risk duties that follow. The register should be fed by procurement, IT asset management and change control, not maintained by hand.

2. Classification you can defend

Each system needs a recorded reason for its risk category: why it is or is not high-risk under Annex III, and whether any exception applies. That reasoning is what an inspector will ask for first. It must be reviewed whenever the use case changes.

3. Evidence captured as you go

Technical documentation, data governance notes, test and accuracy results, human oversight procedures, logs and incident records should be produced by the delivery process itself. If evidence is assembled only when someone asks for it, it will be incomplete and late.

4. Tamper-evident records

Regulators and courts need to trust that records were not rewritten after the fact. Version control, signed approvals and immutable audit logs are the practical answer. For public bodies and regulated sectors, cryptographic anchoring of key records is worth considering. It is a simple way to prove what was known and decided, and when.

A practical 90-day plan

You do not need to solve everything at once. A focused quarter puts most organisations in a defensible position.

• Days 1–30: find everything. Build a complete AI inventory, including shadow AI and features inside SaaS tools. Flag anything that talks to the public or generates content, because Article 50 already applies to it.
• Days 31–60: classify and assign. Record a risk classification and rationale for each system. Name an accountable owner. Identify likely Annex III systems and start the gap analysis for December 2027.
• Days 61–90: move off the spreadsheet. Put the register, workflows and evidence store into a governed platform, whether that is your existing GRC or ITSM tooling or a dedicated solution. Connect it to procurement and change management so it stays current without heroics.

Alongside this, update supplier contracts. Ask AI vendors for their technical documentation, their Article 50 marking approach and a commitment to notify you of material changes.

The public sector has the most to lose

Many of the Annex III categories describe exactly what municipalities and regional governments do: access to public services and benefits, education, employment and, in some cases, safety and enforcement. These organisations also face public scrutiny and access-to-information requests on top of regulatory checks.

The good news is that the public sector already knows how to run registers, approvals and audits. The task is to apply that discipline to AI, with tools built for systems that change every week.

Conclusion

The AI Act is now enforced, and the extra time for high-risk systems is a window, not a reprieve. Organisations that use it to build a living register and a reliable evidence trail will treat compliance as routine. Those still relying on a spreadsheet will find out what it cannot prove at the worst possible moment.

If you would like help assessing your AI inventory, classifying systems or designing a governance platform that keeps itself current, get in touch with Rippon Consulting.

---

Related service: need help applying this in your organisation? See AI governance consulting for EU AI Act readiness, GDPR and NIS2 support.